CVE Vulnerabilities

CVE-2025-40671

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Published: May 26, 2025 | Modified: May 26, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

SQL injection vulnerability in AES Multimedias Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘fk_remoto_central’ parameter on the ‘/webservices/articles.php’ endpoint.

Weakness

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Potential Mitigations

References